CWE-269
DiscouragedImproper Privilege Management
Abstraction: Class · Status: Draft
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
6487 vulnerabilities reference this CWE, most recent first.
GHSA-7C3P-84R8-H79Q
Vulnerability from github – Published: 2026-09-17 15:32 – Updated: 2026-10-01 15:36Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-6rh5-qq4q-97xh. This link is maintained to preserve external references.
Original Description
vm2 through 3.11.6 contains a builtin-module denylist bypass in NodeVM. When the embedder uses the builtin wildcard together with negative entries (e.g. require: { builtin: ['*', '-fs', '-child_process'] }), negative entries are matched by exact module name in lib/builtin.js, so -fs removes only the builtin named fs and does not remove builtin subpaths such as fs/promises. Sandboxed code can therefore call require('fs/promises') or require('node:fs/promises') and reach the promise-based filesystem API despite fs being denied; node: prefix handling is likewise inconsistent (a -node:fs/promises entry does not block require('fs/promises')). Host file creation and writing were confirmed via fsp.writeFile(), and other fs/promises operations (cp, mkdir, rename, rm, rmdir, truncate, read operations, etc.) are also reachable. This issue is fixed in vm2 3.11.7.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "vm2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "3.11.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-01T15:36:33Z",
"nvd_published_at": "2026-09-17T14:18:01Z",
"severity": "HIGH"
},
"details": "## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-6rh5-qq4q-97xh. This link is maintained to preserve external references.\n\n## Original Description\nvm2 through 3.11.6 contains a builtin-module denylist bypass in NodeVM. When the embedder uses the builtin wildcard together with negative entries (e.g. require: { builtin: [\u0027*\u0027, \u0027-fs\u0027, \u0027-child_process\u0027] }), negative entries are matched by exact module name in lib/builtin.js, so -fs removes only the builtin named fs and does not remove builtin subpaths such as fs/promises. Sandboxed code can therefore call require(\u0027fs/promises\u0027) or require(\u0027node:fs/promises\u0027) and reach the promise-based filesystem API despite fs being denied; node: prefix handling is likewise inconsistent (a -node:fs/promises entry does not block require(\u0027fs/promises\u0027)). Host file creation and writing were confirmed via fsp.writeFile(), and other fs/promises operations (cp, mkdir, rename, rm, rmdir, truncate, read operations, etc.) are also reachable. This issue is fixed in vm2 3.11.7.",
"id": "GHSA-7c3p-84r8-h79q",
"modified": "2026-10-01T15:36:33Z",
"published": "2026-09-17T15:32:16Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-6rh5-qq4q-97xh"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92958"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/vm2-before-3.11.7-denylist-bypass-via-fs-promises"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
],
"summary": "Duplicate Advisory: vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes",
"withdrawn": "2026-10-01T15:36:33Z"
}
GHSA-7C4P-2R64-5J3C
Vulnerability from github – Published: 2022-05-24 17:10 – Updated: 2022-05-24 17:10An elevation of privilege vulnerability exists when the Windows Universal Plug and Play (UPnP) service improperly handles objects in memory, aka 'Windows UPnP Service Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0781.
{
"affected": [],
"aliases": [
"CVE-2020-0783"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-03-12T16:15:00Z",
"severity": "HIGH"
},
"details": "An elevation of privilege vulnerability exists when the Windows Universal Plug and Play (UPnP) service improperly handles objects in memory, aka \u0027Windows UPnP Service Elevation of Privilege Vulnerability\u0027. This CVE ID is unique from CVE-2020-0781.",
"id": "GHSA-7c4p-2r64-5j3c",
"modified": "2022-05-24T17:10:55Z",
"published": "2022-05-24T17:10:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-0783"
},
{
"type": "WEB",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0783"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-7C92-C7FQ-PWRG
Vulnerability from github – Published: 2025-10-14 15:31 – Updated: 2025-10-14 18:30Creativeitem Academy LMS up to and including 5.13 contains a privilege escalation vulnerability in the Api_instructor controller where regular authenticated users can access instructor-only functions without proper role validation, allowing unauthorized course creation and management.
{
"affected": [],
"aliases": [
"CVE-2025-56747"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-14T15:16:10Z",
"severity": "MODERATE"
},
"details": "Creativeitem Academy LMS up to and including 5.13 contains a privilege escalation vulnerability in the Api_instructor controller where regular authenticated users can access instructor-only functions without proper role validation, allowing unauthorized course creation and management.",
"id": "GHSA-7c92-c7fq-pwrg",
"modified": "2025-10-14T18:30:27Z",
"published": "2025-10-14T15:31:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-56747"
},
{
"type": "WEB",
"url": "https://suryadina.com/academy-lms-instructor-escalation-3n7b9f2w5k"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-7C9P-Q9CX-HRG3
Vulnerability from github – Published: 2023-10-15 03:30 – Updated: 2024-04-04 08:38IBM Directory Server for IBM i contains a local privilege escalation vulnerability. A malicious actor with command line access to the host operating system can elevate privileges to gain component access to the host operating system. IBM X-Force ID: 263584.
{
"affected": [],
"aliases": [
"CVE-2023-40378"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-10-15T02:15:09Z",
"severity": "HIGH"
},
"details": "IBM Directory Server for IBM i contains a local privilege escalation vulnerability. A malicious actor with command line access to the host operating system can elevate privileges to gain component access to the host operating system. IBM X-Force ID: 263584.",
"id": "GHSA-7c9p-q9cx-hrg3",
"modified": "2024-04-04T08:38:51Z",
"published": "2023-10-15T03:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40378"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/263584"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7047240"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-7CC7-PPV7-MJWP
Vulnerability from github – Published: 2026-09-13 06:33 – Updated: 2026-09-13 12:31The User Registration & Membership WordPress plugin before 5.2.8 does not properly restrict who may author a membership plan or validate the plan a user attaches to their own account, allowing authenticated users with Author-level access and above to assign themselves an arbitrary role and escalate their privileges to Administrator.
{
"affected": [],
"aliases": [
"CVE-2026-80071"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-13T06:16:24Z",
"severity": "HIGH"
},
"details": "The User Registration \u0026 Membership WordPress plugin before 5.2.8 does not properly restrict who may author a membership plan or validate the plan a user attaches to their own account, allowing authenticated users with Author-level access and above to assign themselves an arbitrary role and escalate their privileges to Administrator.",
"id": "GHSA-7cc7-ppv7-mjwp",
"modified": "2026-09-13T12:31:09Z",
"published": "2026-09-13T06:33:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80071"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/a4fbdeea-0d3b-466b-b4b6-4c4db277cd1d"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7CM3-M8RX-JCVP
Vulnerability from github – Published: 2022-03-11 00:02 – Updated: 2022-03-17 00:02Ericsson Network Manager 20.2 has Insecure Permissions.
{
"affected": [],
"aliases": [
"CVE-2021-28488"
],
"database_specific": {
"cwe_ids": [
"CWE-269",
"CWE-732"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-03-10T17:42:00Z",
"severity": "MODERATE"
},
"details": "Ericsson Network Manager 20.2 has Insecure Permissions.",
"id": "GHSA-7cm3-m8rx-jcvp",
"modified": "2022-03-17T00:02:05Z",
"published": "2022-03-11T00:02:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-28488"
},
{
"type": "WEB",
"url": "https://www.ericsson.com"
},
{
"type": "WEB",
"url": "https://www.ericsson.com/en/about-us/enterprise-security/psirt"
},
{
"type": "WEB",
"url": "https://www.gruppotim.it/it/footer/red-team.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-7CVM-G94W-XFG7
Vulnerability from github – Published: 2026-10-10 06:30 – Updated: 2026-10-10 06:30The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.3 via the create_support_user() function. This is due to the function identifying the support account solely by matching against publicly hardcoded constants — user_login 'groundhogg' and email addresses 'support@groundhogg.io' / 'help@groundhogg.io' — where the in_array() email-equality check at line 238 is not a security boundary because any user fully controls their own email value. This makes it possible for an attacker with an account whose user_login is 'groundhogg' and whose user_email matches one of the hardcoded support constants to have that account silently promoted to administrator — and additionally to super admin on multisite when the triggering administrator holds manage_network_options — resulting in full site takeover. Exploitation requires a two-actor flow: the attacker must first obtain or pre-plant an account with the hardcoded credentials (possible when open user registration is enabled or another account-creation path exists), after which a legitimate administrator must invoke the support-access feature via the submit_ticket or process_send_support_access entry points to trigger the promotion.
{
"affected": [],
"aliases": [
"CVE-2026-92975"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-10T06:16:44Z",
"severity": "HIGH"
},
"details": "The Groundhogg \u2014 CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.3 via the `create_support_user()` function. This is due to the function identifying the support account solely by matching against publicly hardcoded constants \u2014 `user_login` `\u0027groundhogg\u0027` and email addresses `\u0027support@groundhogg.io\u0027` / `\u0027help@groundhogg.io\u0027` \u2014 where the `in_array()` email-equality check at line 238 is not a security boundary because any user fully controls their own email value. This makes it possible for an attacker with an account whose `user_login` is `\u0027groundhogg\u0027` and whose `user_email` matches one of the hardcoded support constants to have that account silently promoted to administrator \u2014 and additionally to super admin on multisite when the triggering administrator holds `manage_network_options` \u2014 resulting in full site takeover. Exploitation requires a two-actor flow: the attacker must first obtain or pre-plant an account with the hardcoded credentials (possible when open user registration is enabled or another account-creation path exists), after which a legitimate administrator must invoke the support-access feature via the `submit_ticket` or `process_send_support_access` entry points to trigger the promotion.",
"id": "GHSA-7cvm-g94w-xfg7",
"modified": "2026-10-10T06:30:59Z",
"published": "2026-10-10T06:30:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92975"
},
{
"type": "WEB",
"url": "https://github.com/groundhoggwp/groundhogg/commit/4b413aa6e"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.8.1/admin/help/help-page.php#L224"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.8.1/admin/help/help-page.php#L238"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.8.1/admin/help/help-page.php#L250"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.8.1/admin/help/help-page.php#L298"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.8.1/admin/help/help-page.php#L599"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c355658a-515a-48ed-a114-6a202e23e34b?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7CVQ-76GV-H3MF
Vulnerability from github – Published: 2024-05-17 09:31 – Updated: 2024-05-17 09:31Improper Privilege Management vulnerability in Favethemes Houzez allows Privilege Escalation.This issue affects Houzez: from n/a through 2.7.1.
{
"affected": [],
"aliases": [
"CVE-2023-26540"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-17T07:15:52Z",
"severity": "CRITICAL"
},
"details": "Improper Privilege Management vulnerability in Favethemes Houzez allows Privilege Escalation.This issue affects Houzez: from n/a through 2.7.1.",
"id": "GHSA-7cvq-76gv-h3mf",
"modified": "2024-05-17T09:31:00Z",
"published": "2024-05-17T09:31:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26540"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/houzez/wordpress-houzez-theme-2-7-1-privilege-escalation?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7CWG-2575-3546
Vulnerability from github – Published: 2022-05-13 01:39 – Updated: 2024-11-18 22:54file_open in Tryton 3.x and 4.x through 4.2.2 allows remote authenticated users with certain permissions to read arbitrary files via a "same root name but with a suffix" attack. NOTE: This vulnerability exists because of an incomplete fix for CVE-2016-1242.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "trytond"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"last_affected": "3.0.17"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "trytond"
},
"ranges": [
{
"events": [
{
"introduced": "3.2.0"
},
{
"last_affected": "3.2.17"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "trytond"
},
"ranges": [
{
"events": [
{
"introduced": "3.4.0"
},
{
"last_affected": "3.4.17"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "trytond"
},
"ranges": [
{
"events": [
{
"introduced": "3.6.0"
},
{
"last_affected": "3.6.16"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "trytond"
},
"ranges": [
{
"events": [
{
"introduced": "3.8.0"
},
{
"last_affected": "3.8.14"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "trytond"
},
"ranges": [
{
"events": [
{
"introduced": "4.0.0"
},
{
"last_affected": "4.0.9"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 4.2.2"
},
"package": {
"ecosystem": "PyPI",
"name": "trytond"
},
"ranges": [
{
"events": [
{
"introduced": "4.2.0"
},
{
"fixed": "4.2.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2017-0360"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": true,
"github_reviewed_at": "2024-04-22T22:57:56Z",
"nvd_published_at": "2017-04-04T17:59:00Z",
"severity": "MODERATE"
},
"details": "file_open in Tryton 3.x and 4.x through 4.2.2 allows remote authenticated users with certain permissions to read arbitrary files via a \"same root name but with a suffix\" attack. NOTE: This vulnerability exists because of an incomplete fix for CVE-2016-1242.",
"id": "GHSA-7cwg-2575-3546",
"modified": "2024-11-18T22:54:23Z",
"published": "2022-05-13T01:39:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-0360"
},
{
"type": "WEB",
"url": "https://github.com/tryton/trytond/commit/30e978593733385db3144f8c583eeb4679575cf0"
},
{
"type": "WEB",
"url": "https://github.com/tryton/trytond/commit/a67a7f03c30277515f530cad5950056171ed5bd1"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/trytond/PYSEC-2017-97.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/tryton/trytond"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-security-announce/2017/msg00084.html"
},
{
"type": "WEB",
"url": "http://hg.tryton.org/trytond?cmd=changeset;node=472510fdc6f8"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2017/dsa-3826"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Tryton Information Disclosure Vulnerability"
}
GHSA-7CWW-6V7X-9GJW
Vulnerability from github – Published: 2026-05-26 13:30 – Updated: 2026-06-04 21:31A security vulnerability has been identified in Acer Care Center where the ACCSvc service creates a Named Pipe with a weak Security Descriptor. This vulnerability allows an authenticated local user to connect and send a specially crafted message (message type 0x03) to the pipe, causing the service to crash with exit code 1067 (ERROR_PROCESS_ABORTED). To mitigate this potential local service disruption, Acer requires users to update the software to the latest version.
{
"affected": [],
"aliases": [
"CVE-2026-9490"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-25T08:16:26Z",
"severity": "MODERATE"
},
"details": "A security vulnerability has been identified in Acer Care Center where the ACCSvc service creates a Named Pipe with a weak Security Descriptor. This vulnerability allows an authenticated local user to connect and send a specially crafted message (message type 0x03) to the pipe, causing the service to crash with exit code 1067 (ERROR_PROCESS_ABORTED). To mitigate this potential local service disruption, Acer requires users to update the software to the latest version.",
"id": "GHSA-7cww-6v7x-9gjw",
"modified": "2026-06-04T21:31:19Z",
"published": "2026-05-26T13:30:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9490"
},
{
"type": "WEB",
"url": "https://community.acer.com/en/kb/articles/19668"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:M/U:X",
"type": "CVSS_V4"
}
]
}
Mitigation MIT-1
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Mitigation MIT-48
Strategy: Separation of Privilege
Follow the principle of least privilege when assigning access rights to entities in a software system.
Mitigation MIT-49
Strategy: Separation of Privilege
Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.
CAPEC-122: Privilege Abuse
An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources.
CAPEC-233: Privilege Escalation
An adversary exploits a weakness enabling them to elevate their privilege and perform an action that they are not supposed to be authorized to perform.
CAPEC-58: Restful Privilege Elevation
An adversary identifies a Rest HTTP (Get, Put, Delete) style permission method allowing them to perform various malicious actions upon server data due to lack of access control mechanisms implemented within the application service accepting HTTP messages.